03 Nov 2026
A registrar lock stops your domain from being transferred while the lock is on. A registry lock goes further: it freezes transfers, DNS changes and deletion at the registry level, and can only be lifted through a manual, verified process.
The short version: registrar lock protects you from casual mistakes and basic attacks. Registry lock protects you even if someone steals your registrar password. Here is how each works and which domains need which.
Every domain has status codes, called EPP status codes, that tell the registry what is allowed. Some codes are set by your registrar (they start with "client"). Others are set by the registry itself (they start with "server"). Locks are simply these codes switched on.
You can see the codes on any domain with an ICANN RDAP lookup. If you see clientTransferProhibited, your registrar lock is on.
A registrar lock is a set of client status codes your registrar applies, mainly clientTransferProhibited. Many registrars also offer clientUpdateProhibited and clientDeleteProhibited.
That last point is the weakness. Most hijacks start with a stolen registrar login. Once inside, the attacker simply unlocks the domain.
A registry lock applies server status codes at the registry: serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited. Your registrar cannot change them on its own. To make a change, an authorised person must request it, the registrar verifies the request, often by phone with a passphrase, and then the registry lifts the lock for that change.
| Feature | Registrar lock | Registry lock |
|---|---|---|
| Status codes | clientTransferProhibited (plus client update and delete) | serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited |
| Applied by | Your registrar | The registry, at your registrar's request |
| Removed by | Anyone with your registrar login | Manual verified process only |
| Blocks transfers | Yes | Yes |
| Blocks DNS and contact changes | Only if update lock is set | Yes |
| Survives stolen login | No | Yes |
| Cost | Usually free | Paid per domain |
| Speed of changes | Instant | Hours, by design |
You do not need registry lock on every domain. Use it on the few domains that would hurt most if hijacked.
For everything else, a registrar lock plus MFA and alerts is usually enough. Registry lock availability depends on the extension and registrar, so check support for .in and other country domains with your provider.
Learn the full attack picture in how domain hijacking happens.
The following scenarios are illustrative samples, not verified client case studies.
Client: Non-banking finance company, Mumbai
Challenge: A staff member entered their registrar password on a phishing page.
What we did: Registry lock was active on the main and customer portal domains, with MFA on all accounts. Credentials were reset and logs reviewed.
Results:
No DNS, contact or transfer change was possible
Incident closed in 4 hours
Registry lock extended to the API domain
Client: D2C e-commerce brand, Hyderabad
Challenge: The brand saw lookalike attacks before past sales and feared a direct DNS hijack during peak traffic.
What we did: Registry lock on the main and checkout domains, DNS change freeze for the sale period, alerting on any request to lift the lock.
Results:
Zero unauthorised changes during the sale
Clear change window agreed with marketing
Lock process documented for future campaigns
Registrar lock is the seatbelt every domain should wear. Registry lock is the vault for the handful of domains your business cannot live without. Together with MFA and monitoring, they stop most domain hijacking before it starts.
Flying Stars sets up both as part of our domain protection services.
